CVE-2021-33691: XSS
NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.SAP NetWeaver Development Infrastructure Notification Service allows a threat actor to send crafted scripts to a victim. If the victim has an active session when the crafted script gets executed, the threat actor could compromise information in victims session, and gain access to some sensitive information also.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-33691?
CVE-2021-33691 is considered a medium severity vulnerability due to its potential for exploitation via Cross-Site Scripting.
How do I fix CVE-2021-33691?
To fix CVE-2021-33691, ensure your SAP NetWeaver Development Infrastructure is updated to the latest patch version that addresses this vulnerability.
What impact does CVE-2021-33691 have on SAP NetWeaver users?
CVE-2021-33691 allows attackers to execute scripts in a user's browser, potentially leading to data theft or session hijacking.
Which versions of SAP NetWeaver Development Infrastructure are affected by CVE-2021-33691?
CVE-2021-33691 affects versions 7.31, 7.40, and 7.50 of SAP NetWeaver Development Infrastructure.
Is user interaction required to exploit CVE-2021-33691?
Yes, user interaction is required as the victim must be tricked into clicking on a malicious link or accessing a crafted page to trigger the XSS vulnerability.